December 2003 - cypherpunks-legacy

Re: My Key
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

Hugh, I agree with most of what you say. However, my point was, that say someone wants to become Wonderer (I mean, it's great being me, who wouldn't want to?), they could forge a message as coming from me and include a public key. From them on, they would be wonderer, and it would be more believable than if I sent the messages myself. They could prove they were me better than I could. My point was that if someone sent me private mail, and I responded with my public key, that would be much less likely to be a forgery. However, I will concede. Here's my public key, and after this one, I'll sign my messages. If anyone wants confirmation of my public key, or wants to sign it for me let me know. However, since there is no certificate, I probably wouldn't sign your key under the same circumstances, so it's up to you. The problem I have with public key cryptography is that it is easy for an imposter to publish a public key and get people to believe that it is valid. Wonderer -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQBNAizOm20AAAECAMfolwrccyUip9pUcpLQjLSw0BWgmIhW2v1YjGOxTqJdU8+v Nh9eXckudk6h6LCcs7KIn++PSl04HWRMm6ugMP0ABRG0CHdvbmRlcmVy =foLb -----END PGP PUBLIC KEY BLOCK----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Chaos - A noun we can live with
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

> i like cpunx the way it is: uncontrolled. I too agree with this statement up to a point. I don't believe there should be any control by the list management. However, I see no problem with the democratic process of participants on the mailing list saying whatever they can to quiet those who are disrupting the intelligent discussions that are taking place with useless banter and silly flames. Personally, I always found flaming to be an unproductive way of expressing one's self. Constructive criticism is always better in my view. Wonderer p.s. something's wrong with my pgp, I'll start signing soon. Sorry. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Signing our keys
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

Well, it is true that you have built up a reputation on the list. I am trying to do the same. Quite an interesting experience. It seems to me that we have an interesting dilemma here. If we are willing to sign a key based on an entity that we KNOW does not really exist, then what does a signature mean? You have been an active and productive participant on cypherpunks for quite some time now, so if that's what I'm saying by signing your key, then I would be willing to. Off line methods wouldn't work in this case because we aren't real. Something strange is going on in the word when nym's are signing each other's keys... I am going to register my public key as you suggested. If you send me a signed copy, I will add it to my keyring. Please send me your public key, and I will sign it for you. The world is becoming a more interesting place. Wonderer p.s. I believe something may be wrong with my pgp here at my oranization. I type: pgp -sat file -u wonderer +cleartext=on as someone on the list suggested, and this does not work. What command do you use to sign your messages? I will include a detached signature of this message below. -----BEGIN PGP MESSAGE----- Version: 2.3 iQBVAgUALM/wPh1kTJuroDD9AQEq5AH+Nxou8vx4F3JsDhSDvUpy6P0yvXz2Be/F Q32ZwM+AiBD/Sijb/XX3Z2jixDTWP/xs/lr2Iw1tmbK8RBWS4iZDLQ== =rjX8 -----END PGP MESSAGE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Re: Signing our keys
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In an interesting list message, Wonderer wrote: >It seems to me that we have an interesting dilemma >here. If we are willing to sign a key based on an >entity that we KNOW does not really exist, then what >does a signature mean? Here's a terrific example of one of the interesting differences between the PEM-style key hierarchy and the PGP web. Consider that any entity (real or spoofed) can own a key pair in either model. A PEM key is bound to a particular identity by a certificate. Right now, you can only get these certificates from entities that want some concrete evidence of your True Name; this makes sense, since the certificate establishes that key X belongs to True Name Y. PGP, OTOH, doesn't have any direct equivalent of a certificate. If I get Wonderer's key with no signatures, I can't guarantee anything about the association between that entity and the key I get. If I get that same PGP key with signatures from Phil Karn and L. Detwiler, I know that they're willing to certify the assocation. Does that mean anything? Well, it depends on who the signers are :) A set of PGP signatures can be equivalent to a PEM-style certificate; that is, the set of signatures on a key, establishing that a particular key belongs to a particular entity, can potentially be as trustworthy as a certificate from Dun & Bradstreet or RSA. The PGP feature that a key doesn't have to belong to the True Name of an entity is a big plus in my book; otherwise, we'd have no Wonderer, no deadbeat, and no S. Boxx. - -Paul - -- Paul Robichaux, KD4JZG | Caution: cutting edge is sharp. Avoid contact. Intergraph Federal Systems | Be a cryptography user - ask me how. ** Of course I don't speak for Intergraph. ** -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNAJ2yA78To+806NAQF/DAQApsjQgIjW26GPvL2kINfCzTGyxn6zXJr9 OZVdLjPRe/J7eudxXfe5q7MlENxyomXgXqnUr5AxmTEjPzWCj63D1Yq2qr2Gcjq+ i7YTg8d9P+L+yTsTVUBk+ZIbBv+AFnD35yCEQnIC5nCE0kK644cpwa1FjDyLla01 2m4fvPNTOnM= =ZF43 -----END PGP SIGNATURE-----

2 1

Re: Words, words, words
by J. Michael Diehl 17 Dec '03

17 Dec '03

According to wonderer: > > Some words that can hurt you: > - death threats > - "You're fired" > - "I don't want to see you ever again." > - "You're ideas are stupid; take them somewhere else." > - "We see no option but to declare war!" > you get the idea. You forgot: Bitch, nigger, queer, spick, Nazi, dumbfuck, chink, wop, etc. Simply a call for people to try to be a bit more polite to each other. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

Re: Signing our keys
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

an41418(a)fi.penet.anon (wonderer) writes: >It seems to me that we have an interesting dilemma >here. If we are willing to sign a key based on an >entity that we KNOW does not really exist, then what >does a signature mean? You have been an active and >productive participant on cypherpunks for quite some >time now, so if that's what I'm saying by signing >your key, then I would be willing to. Off line methods >wouldn't work in this case because we aren't real. Certification establishes a relationship between a public key and a True Name. When there is no True Name, or the True Name is not to be revealed, certification is irrelevant. For a nym to prevent anyone else for masquerading as itself, it should announce a public key in its first appearance on the net, and thereafter sign every message with its private key. This guarantees that all such messages emanate from those with access to the private key. Certification is irrelevant. What does become difficult for a nym is key revokation. If the nym's private key is compromised, anyone with access to it can send a message purporting to revoke the key and announcing a new one. Such a revokation cannot be certified unless its issuer not only reveals their True Name but somehow establishes to the satisfaction of whoever is certifying it that they are the True Name of the nym. Or as someone put it more succinctly, keys *are* the identities of the future net. -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

Re: My Key
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

> From: an41418(a)anon.penet.fi (wonderer) > > say someone wants to become Wonderer (I mean, it's > great being me, who wouldn't want to?), they could forge > a message as coming from me and include a public key. [...] > The problem I have with public key cryptography is that > it is easy for an imposter to publish a public key and > get people to believe that it is valid. As long as no certification agency is involved, a public key only stands for itself. It only weakly associates a key with a name. It does NOT associate a key with a person, or an email address. And this association is not even unique, you could have several names with the same public key, and the same name with several public keys. In other words, the only thing that authenticates the messages is the key itself, the key is now the only significant name. The name is merely a poor mnemonic to the key (more or less). No matter what, any "John Smith" out there has an arguable right to call himself "John Smith". The situation does not improve as communication infrastructures become more global. So, even though you were the first on this list to use the name "wonderer", as long as you don't post a public key for it, somebody else can pre-empt you and claim that name and post a key, and that would not prevent you from posting a key for the same name yourself in the future. (is that confused enough?) The only way to distinguish same names for different keys is if people automatically collect key-name pairs and their mail readers shows key-names as author, not just name (and that's not a reliable or likely way to go. Assuming here there is only email and posting to distribute keys.) You say somebody would forge a mail from your address to "claim" your name... They wouldn't need to: How many of us check your email address in the header when we see "wonderer". We don't remember your email address, just "wonderer". We wouldn't remember your key either, just "wonderer" again. Only a fancy mail reader would tie together all the different messages you posted under the same key. So, does it matter and what can we do? Well as long as the only key propagation mechanisms are email and posting, we can't do much. If you start talking as "Some Name" with or without a posted public key, and somebody else posts one as the same name: - you can counter with a key for "Some Name" yourself. - you can sue if "Some Name" is sufficiently associated with you (first and last name, trademark...), and insufficiently with the other (not his name or less valid trademark), and if the other is in a jurisdiction where you have a recourse. - you can start an online war between the two that essentially will make the name impossible to use for anybody (quasi-universally kill-filed... for a while) - you can claim a Better Name "The One True Some Name", and post your same public key for it. Until he does the same. - you can wait for, or better yet :-), write mail readers or list software that tend to prefer keys and signatures over names and mail addresses. The possibilities for fun, forgery, spoofing, and flaming are endless... Until the list software starts associating keys with names on a first come first serve basis (or by chains of certificates and in-person meetings, as a way to settle disputes). Pierre. pierre(a)shell.portal.com

1 0

Re: Signing our keys
by smb＠research.att.com 17 Dec '03

17 Dec '03

The PGP feature that a key doesn't have to belong to the True Name of an entity is a big plus in my book; otherwise, we'd have no Wonderer, no deadbeat, and no S. Boxx. It is, of course, worth noting that the PEM specs make explicit provisions for aliases; it's just up to some issuing agency to decide to issue them. And if no one wants to -- well, no one has to sign an anXXXX address's key, either. --Steve Bellovin

1 0

Re: Tim May, Detweiler and Me.
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

> Granted, Mr. Detweiler has been a royal twit. But then, so have many > others on the list in reply to him. Shame on the lot of you. Oh, fuck off. Take your preaching and moralizing to the net. In fact, all of y'all interested in reforming our black hearts: get fucking lost. I want to hear Hal Finney's description of DC-nets, and you are just plain in the way. Nowhere, Man

5 4

PGP automation
by holland＠CS.ColoState.EDU 17 Dec '03

17 Dec '03

Right now, it is a complete pain in the ass for me to encrypt or sign messages using PGP. The reason is because I have my email account on one of CSU's unix machines, so I have to do my posting there, while my PGP stuff lives on my PC in my apartment. Usually, I check my mail and read news by calling CSUNet over my modem, but if I want to encrypt, decrypt, sign or check the signature of a message, I have to zmodem the message to my machine, log off, decrypt or check the message while offline (or at least shelled into DOS), type up a reply, manually encrypt it and finally get back into my term program and zmodem the reply back up to CSUNet and mail it. I don't really want to run PGP on CSUNet, since I don't trust their machines like I trust mine, but I am thinking about doing that and generating a key which I would be wiling to use for less secure stuff. Anyone here have any other suggestions on making encryption less of a pain? Doug | Doug Holland | Proud member of: | holland(a)beethoven.cs.colostate.edu | Mathematicians Against Drunk Deriving | Finger for PGP 2.2 key |

4 4

Hackers 9.0 Crypto Panel, the Semi-Final Agenda
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Many of you will be attending Hackers 9.0 beginning next Friday at Lake Tahoe. This message is for you. The Hackers Conference panel on crypto has come together nicely. Glenn Tenney has asked us to move it from Saturday afternoon to Friday night, 9:30 to 11, and I've agreed. I don't think this should conflict with any other sessions, as this is a one-track section too. If there are conflicts, let me know and we can arrange substitutes or somesuch. A few weeks ago I solicited your advice on topics and asked for any volunteers. This is what came out of this process: * a panel discussion, as opposed to the short speeches of last year. * a discussion of whatever is of main interest after the panel makes their initial points. * panelists: - Phil Karn, on Internet encryption - Peter Honeyman, on issues of anonymity and trust - John Draper, on the spread of PGP - Eric Hughes, on digital money and banking - Mike Godwin, on legal issues surrounding crypto If any of you has changed your mind, let me know as soon as you can. And if anyone else has some topics they really want to talk about, let me know...maybe you can be added or be a sub for anyone who drops out. I'll try to moderate this thing and keep any one topic from sucking up all available time. Clipper and the legal issues surrounding PGP are two of the obvious things that the audience could "demand" more attention be given to. I think we of course _should_ talk about these issues, but we also want to bring up new material and not just today's "headlines." (For example, a year ago the "key escrow" stuff was relatvely obscure next to the Steve Jackson Games issue....then key escrow blossomed into "Clipper" just six months later and is now the Really Hot Topic. The use of anonymous remailers in the breaking of the Verilog encryption system is similarly a portent of things to come.) These topics will likely come up many times in the audience participation phase. And if Phil Zimmermann attends, which I've not been able to confirm, I expect he will be on the panel, or will participate centrally in the "BOF" (birds of a feather) session which I expect will start after our panel). (In fact, if he attends, it might be good to just let him speak for as long as he wants at a BOF. I remember Cliff Stoll speaking until nearly 4 in the morning a couple of years ago.) See you there! -Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Re: Signing our keys
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Well, Paul Robichaux, actually, that message was not intended for the list, as you seem to realize. However, given your message, and the thoughts that it sparked, I guess it wasn't such a bad thing after all that my lack of sleep caused me to be careless. I'd like to know how many people check the signatures at the end of messages. Maybe whenever there's a questionable one, or if someone claims that a message seemingly from them is a spoof. So, my question is: how do I get people to agree to sign my key when I don't really exist? Is my net reputation enough for you? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNARpB1kTJuroDD9AQEiEAH/etWoc0WA89+Rb9ojM4jRQflZQNjVrnYx r8YSYpq1k+G2W6eDPA+m0mQnWqaKGizKwPJecXkpQGfW5YawWSOg6w== =kZgv -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

pgp versions
by hortonb＠source.asset.com 17 Dec '03

17 Dec '03

I would like to use PGP on multiple platforms, and am unsure of which version I should use to maximize my interoperability with other PGP users. In the PGP documentation, "hmiller(a)lucpul.it.luc.edu" is listed as a source of info regarding the availability of PGP for various computer platforms. I EMailed Mr. Miller but recieving no response. Finger indicates he hasn't used that account in over a month. John Draper suggested I contact you. I am unable to read PGP2.23 files created under DOS on the Macintosh running MACPGP2.2. I saw nothing in the "newfor23" file to indicated that the PGP file format had been changed so as to be incompatible. Are you familiar with this problem? Is there a MACPGP2.23 in the works? -bh

1 0

Re: Signing our keys
by jim＠nimrod.suite.com 17 Dec '03

17 Dec '03

"Eric Hughes" writes... > RSA is running a persona certificate server for PEM keys. > They don't ask for anything. Their latest brochure > diagrams these as "anonymous internet users." I don't > know the address, but I do know that six months ago it was > running and being tested. > Here's an extract from the latest RSA Newsletter: ------------ _RSA Certificate Services Center Opens for Business_ Last month, the RSA Certificate Services Center (CSC) officially opened for business. Right now, today, you can obtain real certificates with your name, public key, and organizational affiliation safely embedded in a cryptographically tamper-proof digital document. [stuff deleted] GETTING A CERTIFICATE There are two primary types of certificates that are supported by the RSA Certificate Service Center: affiliated and unaffiliated. [stuff deleted] There are three ways to get a certificate: [stuff deleted] 3. You can purchase individual unaffiliated certificates directly from the CSC. [stuff deleted] For more information contact George Parsons, CSC Manager, at 415/595-8782. ------------ Jim_Miller(a)suite.com

1 0

RE: pgp and procmail
by J. Michael Diehl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi again! I've gotten some real good replies to my question regarding whether I should use procmail to send pgp advertisements. The overwhelming response has been that I shouldn't. I will instead, as was suggested, put my advertisement in my heading, like my pgp key info. Any suggestions as to what to put there? I have also been asked if I intend to post my procmail rc file. Yes, I do. As soon as I have tested it and feel finished, I will post it to the list. I've only been using procmail for ~4 days. By the end of the week-end, I will have procmail preprocessing my incoming encrypted email, a non-secure key on the mainframe to sign quick letters with, and a secure message-signing and transport system on my pc at home. I intend to run the link program from within Telix and Use Mike Ingle's encrypted disk driver. Short of burying my computer under 500 feet of concrete, what else can I do to build a reasonably secure system at home? Just for the Hell of it. ;^) -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLMsjE1WjzUwifAbxAQG2fAQArUMrQBKa0o2n3HieGO/aUCZX1CsHgpXY QluVsGK1I8JPqxVdo6hPwl4M8gE6VSNimUjo7Sp/a/UzonjdS7BkOYX+V2/1oIv3 iHi6Y0ms0FmXBP/m7/ZZq2t2BQGCmLXiJ9M4r57nnZsqagsVUXStr0vMzWN/V+fd R3qdl3Iopps= =VDMU -----END PGP SIGNATURE-----

1 0

["Tom Jones": ViaCrypt PGP for MS-DOS Now Shipping]
by Marc Horowitz 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Thu, 28 Oct 93 15:58:57 -0700 To: marc(a)gza.com From: "Tom Jones" <wk01965(a)worldlink.com> Organization: ViaCrypt div Lemcom Systems Subject: ViaCrypt PGP for MS-DOS Now Shipping You recently contacted ViaCrypt and asked for information about ViaCrypt PGP, and that it be sent to you electronically. ViaCrypt PGP Version 2.4 for MS-DOS is now available for shipment. Appearing below is information from our literature, along with details about ordering ViaCrypt PGP. ViaCrypt Introduces... ViaCrypt(tm) PGP(tm) Pretty Good Privacy(tm) Protect The Privacy Of Your Files And E-Mail Messages ===================================================== Your files and messages. They're personal. They're private. And no one's business but yours. You may be planning a political campaign, preparing your taxes, or negotiating a contract. Whatever it is, you don't want your private electronic mail (e-mail) or confidential documents read by anyone without your permission. ViaCrypt PGP is the perfect tool for individuals, small businesses, large corporations, or anyone who values the privacy of their proprietary or sensitive information. A software program that combines powerful cryptography with ease-of-use, ViaCrypt PGP provides the ability to encrypt files and messages. Using Digital Signatures, it also provides a facility for message authentication. You Control The Keys To Your Privacy ------------------------------------ With ViaCrypt PGP, you are in complete control of your privacy. YOU create your keys. YOU decide how long they are valid. YOU decide who to trust. Other systems require you to place your trust in a disinterested third party, or worse yet, a chain of faceless people you've never met. ViaCrypt PGP allows you to do so too, but never requires it. YOU are always in control. ViaCrypt PGP is for people who don't want to surrender control of their privacy. Strong Cryptography ------------------- ViaCrypt PGP combines the respected RSA system for Public Key Cryptography with state-of-the-art IDEA(TM) encryption to protect your files and electronic mail, and to let you communicate securely with people you have never met. Features -------- * Protects the privacy of your files and e-mail messages. * Digitally signs files and e-mail messages to protect them from tampering and to authenticate the sender. * Sophisticated key management * RSA/IDEA hybrid encryption scheme * Message digests for digital signatures * Data compression before encryption * Simple, command-line interface for ease of use * Easy-to-understand documentation How It Works ------------ ViaCrypt PGP combines the best features of conventional and public key cryptography. Using conventional secret key cryptography, a file can be encrypted using a key, then sent to the recipient. The recipient decrypts the file using the same key. Conventional cryptography is very fast, but it is difficult to provide the recipient with the key in a secure manner. Public key cryptography eliminates the problems associated with distributing keys. Using public key cryptography, the key is split into two halves: A private key that you never reveal, and a public key that you can freely distribute. The public key and private key are mathematically related such that anything encrypted using the public key can be decrypted only using the matching private key. In a process invisible to the user, ViaCrypt PGP creates a temporary one-time key, called a session key, to encrypt the file using fast conventional cryptography. Then the recipient's public key is used to encrypt the session key. The encrypted session key is sent along with the encrypted file to the recipient. Once the file is encrypted, only the intended recipient(s) can read it. Using a single ViaCrypt PGP command, the recipient uses her own private key to recover the session key, then uses that key to quickly decrypt the file. Message authentication is also provided. The sender's own private key can be used to encrypt a 'fingerprint' or message digest of the file or message. This creates a digital signature of the file or message, which the recipient can check by using the sender's public key to decrypt and compare with the original. The digital signatureproves that the sender was the true originator, and the file or message has not been altered by anyone else. ViaCrypt PGP Enables You To: ---------------------------- * Encrypt files or messages, sign them, or both * Decrypt previously encrypted files or messages * Check previously generated digital signatures * Encrypt messages to multiple recipients * Encrypt files or messages using just conventional cryptography * Generate your own keys * Easily add and remove other people's public keys to your 'key ring' * View the keys on your key ring * Revoke your keys * Re-format encrypted files so they can be sent through e-mail channels * Sign and certify other people's public keys * Specify 'trust parameters' for various keys Requirements ------------ * IBM Compatible PC * MS-DOS Version 3.3 or later * 640K RAM * 3-1/2 or 5-1/4 inch floppy disk drive ================================================================= What You Get * ViaCrypt PGP on both 3-1/2 and 5-1/4 inch diskettes * User Manual * License Agreement * Software registration card ================================================================= Pricing (Licensed for sale in USA and Canada only) ViaCrypt PGP Version 2.4 for MS-DOS (Single User) $ 199.95 (Promotional price good thru December 31, 1993: ($ 99.98) ViaCrypt PGP Version 2.4 for MS-DOS (Five User) $ 599.95 (Promotional price good thru December 31, 1993: ($ 299.98) ViaCrypt PGP Version 2.4 for MS-DOS (Twenty User) $1649.95 (Promotional price good thru December 31, 1993: ($ 824.98) Please add $8.00 shipping and handling per order If you live in AZ, CA, IL, TX, WA, NY, NJ, or GA please add appropriate sales tax. ================================================================= How To Order Four ways to order: 1. Via telephone at 1-800-536-2664 (orders only) 8 a.m. to 5 p.m. MST Monday - Friday. We accept American Express, Discover, MasterCard, or VISA. 2. Via FAX at (602) 943-2601. We can FAX you a pre-printed order form that you can fill in and FAX back to us. 3. Via Mail. Send your Check or Money Order to: ViaCrypt ViaCrypt Order Desk 2104 W. Peoria Ave. Phoenix, AZ 85029 4. Via company purchase order, providing you have been pre-approved for credit. Please contact ViaCrypt for terms, conditions, and credit information. ================================================================= For more information, contact ViaCrypt at (602) 944-0773. U.S. Patent No. 5,214,703 licensed by Ascom Tech, AG. U.S. Patent Nos. 4,200,770, 4,218,582, 4,405,829, and 4,424,414 Licensed Exclusively by Public Key Partners ------- End of Forwarded Message

1 0

Paranoid
by major＠dcd.wa.gov.au 17 Dec '03

17 Dec '03

A nym of no particular repute <nobody(a)Menudo.UH.EDU> writes: > Does PGP compress the text before it is encoded? yes > Does this allow a cracker to search for the compression's signature > after every attempt? There is no "signature". Unix compress(1) leaves a signature but there is nothing in the math of compression which forces a compression algorithm to do so. Major

1 0

No Subject
by m-sh8481＠SPARKY.CS.NYU.EDU 17 Dec '03

17 Dec '03

Dear friends, I am new to this group but interested in cryption and encryption and also about Public keys and Private keys. The only thing I know about them is that I have read their man pages on the Sparc stations. But I donot still know where to look in for the Public and the Private keys and how to change them etc. Could someone be kind enough to give me a little i/p that how should I proceed on to become a cypherpunk on this mailing list. I know it might be awkward for many of you. But I guess I have to start somewhere. ----Thanking in advance Hardayal Singh

1 0

ID of anonymous posters via word analysis?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <Pine.3.87.9310291032.A24998-0100000(a)crl.crl.com> arthurc(a)crl.crl.com writes: > I think that identification by buzzwords, habitual misspellings, etc. > could be used to identify anonymous posters. Sentence structure is also > revealing. Le style, c'est l'homme, said Voltaire. Of course, it all > comes down to how much time and effort you want to put into proving, say, > that SBoxx=LDetweiler. I had a go at this just for fun when an8785 was doing his thing. I'm pretty sure I identified him correctly in the end. (The guy I thought it was, when I asked him, said 'If I were I wouldn't tell you', whereas all the other people I suspected but not as strongly all denied it violently, heh heh heh) I think this sort of analysis could be automated to a reasonable extent, to cut out the TypeI errors that the guys who did Shakespeare/Bacon analysis made. It's very easy to fool yourself if you don't have predefined criteria of comparison and a rigid marking scheme. I'm fairly sure that a sufficiently detailed analysis looking at enough different points of style would still catch someone's fingerprint even if they went out of their way to disguise their postings. The only approach I can think of that would be successful in hiding individual style is for person A to write something, person B reads it quickly, then attempts to write something with the same semantic content, but of course it will have B's grammar and phraseology and punctuation idiosyncracies. (And this only works if B is not a net poster, otherwise you recognise B and work out who his friends are :-) ) G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

3 2

pgp request?
by J. Michael Diehl 17 Dec '03

17 Dec '03

Hi all. I'm playing with procmail and trying to get it to automate many of the pgp- related email operations. I have it set up now, so that it validates all pgp- signed email that I receive. It will also automatically add any pgp keys which are in an incoming message. My problem, though, seems to that of philosophy. I also have the capability to check each message to see if pgp was used at all. If it was not, I could send the sender a one-time-only "advertisement" for pgp. Also, I could send a one-time-only "thank you" to people who send me email that is signed/encrypted. I'm really having difficulty deciding if this is something I want to do. Please send me your comments. Thanx in advance. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

archive request bounce
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

I mailed off the posting archive to everyone that requested one (I think). However, something bounced. If you wanted one and didn't get one, e-mail me back. caffienated... -john.

1 0

Paranoid
by nobody＠Menudo.UH.EDU 17 Dec '03

17 Dec '03

Does PGP compress the text before it is encoded? Does this allow a cracker to search for the compression's signature after every attempt? Is there a checksum that a cracker could use to test for success after every attempt? Would using UUENCODE on the text and deleting the "begin/end" lines before encrypting it have a synergistic effect on the difficulty of cracking a secret key from that particular message? Is there an easy way to generate keys larger than 1024 bits?

2 1

ViaCrypt PGP
by norm＠netcom.com 17 Dec '03

17 Dec '03

Congratulations and good luck. I have a Mac and will not be buying you PC version. I might well buy a Mac version especially at the $99 introductory price. I hope you send me e-mail when you have a Mac version. I am impressed with PGP and would be willing to pay for a "legal" version. I have no important secrets but may still buy the program as a matter of principle. I have a couple of (free) ideas you may be interested in. (Consider this a customer request if there are any lawyers about.) As I understand PGP, it generates random numbers by timing keystrokes for at least two purposes, first to avoid known plain text and second to choose large primes for the RSA key. If there were an option to generate those random numbers by a published mapping from input text then the following benefits would accrue: The paranoid could compare the output of your program with others written to the same spec to gain assurance that programs operated to spec. This is especially critical in key generation. I would propose that the spec would be to choose the prime from among an arithmetic sequence A+Bn where A and B are derived from the input text. The paranoid would know that the cipher text contained no covert or subliminal information. Both of these benefits would accrue without having to read the code for either of the systems compared. It would need to assume no collusion to achieve this assurance. Some paranoids would see the threat of exposure as sufficientreason to trust the program. Another advantage is that I could run your PC version on my Mac using SoftPC. I understand that PGP does not get random keystroke timing under SoftPC. Yet another advantage would be to those who wish to keep their private key in their head. This would require remembering and correctly typing about 1000 characters at each computer sesion. An optional text checksum would thus be strategic and not compromise security. I understand that the quality of keyed data may be poor. Shannon estimated that such data could provide about one bit of information per character. It might be difficult to provide a sufficient warning to users unfamilliar with information theory on the dangers of known or guessed sayings as input text. Unlike some cryptographic applications weekness in the random numbers does not induce sudeen failure. The effort in breaking a public key declines slowly with declining quality in the random numbers. Keystroke timing may well be the best default however.

1 0

Formal Methods for the Analysis of Authentication Protocols
by peter honeyman 17 Dec '03

17 Dec '03

avi rubin and i recently completed a survey paper that may be of interest to cpunx. it is available via anonymous ftp from citi.umich.edu: /afs/umich.edu/group/itd/citi/public/techreports/PS.Z/citi-tr-93-7.ps.Z i have attached the abstract to this message. peter =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Formal Methods for the Analysis of Authentication Protocols A D. Rubin P. Honeyman Center for Information Technology Integration University of Michigan Ann Arbor In this paper, we examine current approaches and the state of the art in the application of formal methods to the analysis of cryptographic protocols. We use Meadows' classification of analysis techniques into four types. The Type I approach models and verifies a protocol using specification languages and verification tools not specifically developed for the analysis of cryptographic protocols. In the Type II approach, a protocol designer develops expert systems to create and examine different scenarios, from which she may draw conclusions about the security of the protocols being studied. The Type III approach models the requirements of a protocol family using logics developed specifically for the analysis of knowledge and belief. Finally, the Type IV approach develops a formal model based on the algebraic term-rewriting properties of cryptographic systems. The majority of research and the most interesting results are in the Type III approach, including reasoning systems such as the BAN logic; we present these systems and compare their relative merits. While each approach has its benefits, no current method is able to provide a rigorous proof that a protocol is secure.

1 0

ANON: message padding
by nobody＠Menudo.UH.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The remailer at elee9sf(a)menudo.uh.edu now pads messages. So as not to be too annoying, messages under 1K are padded to 1K; larger messages are untouched. Padding is calculated by the size of the message body as it goes to sendmail - the header doesn't enter in the calculation. This remailer also caches messages until midnight; this is being mailed out early because I forced it. This message is shorter than 1K, so there will be some padding below (after the signature block). Coming soon: explanation of what I'm doing :-) Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNEygIOA7OpLWtYzAQFTggP/ZNq3NbDzKAAwflRxtFBQ9XBohHnlnYWz gPY35v4tyLyalxMFLrjg2RXqRCZwwsMVKeXdq8x4m7m8LETV2cQyBJpHZUFJNRk6 9it59a47Uvk4MxSLWwsNE7NeBagjT4XluYjYBQqMxXc7Cu641IGUvPNpkwtBfEKy IklE0fm7Z0A= =eNuW -----END PGP SIGNATURE----- FktH6kRoEhfyrw8HVOVWZjMtv4 GyLW511PVKywmZzC8hn7TzWU7btUpKc7tdB4JhJpEoDz2AwxcjGRgyVpvoss3cO

1 0